app.py

#!/usr/bin/env python3
"""
CVE Insight Tool - Web Application
"""

import os
import json
import logging
from datetime import datetime, timedelta, timezone
from typing import List, Optional, Dict, Any
from flask import Flask, render_template, request, jsonify, session, send_file, redirect, url_for, flash, g
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
from flask_caching import Cache
from werkzeug.exceptions import RequestEntityTooLarge
import tempfile
import io
import csv
import html

from services.cve_service import CVEService
from config import Config
from models.cve import CVEData

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',
    handlers=[
        logging.FileHandler('cve_webapp.log'),
        logging.StreamHandler()
    ]
)
logger = logging.getLogger(__name__)

app = Flask(__name__)

# Load configuration from Config class
app.config.from_object(Config)

# Initialize rate limiter
limiter = Limiter(
    app=app,
    key_func=get_remote_address,
    default_limits=[app.config.get('RATELIMIT_DEFAULT', "10 per minute")],
    storage_uri=app.config.get('RATELIMIT_STORAGE_URL', "memory://")
)

# Initialize caching
cache = Cache(app, config={
    'CACHE_TYPE': app.config.get('CACHE_TYPE', 'simple'),
    'CACHE_DEFAULT_TIMEOUT': app.config.get('CACHE_DEFAULT_TIMEOUT', 300)
})

# Enhanced session security configuration
app.config.update(
    MAX_CONTENT_LENGTH=16 * 1024 * 1024,  # 16MB max file upload
    SESSION_TYPE='filesystem',
    SESSION_PERMANENT=False,
    SESSION_USE_SIGNER=True,
    SESSION_COOKIE_SECURE=os.environ.get('FLASK_ENV') == 'production',
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE='Lax',  # CSRF protection
    PERMANENT_SESSION_LIFETIME=app.config.get('PERMANENT_SESSION_LIFETIME', timedelta(hours=2))
)

# Initialize app with config
Config.init_app(app)

@app.after_request
def add_security_headers(response):
    """Add security headers to all responses"""
    # Prevent clickjacking
    response.headers['X-Frame-Options'] = 'DENY'
    
    # Prevent MIME type sniffing
    response.headers['X-Content-Type-Options'] = 'nosniff'
    
    # XSS protection
    response.headers['X-XSS-Protection'] = '1; mode=block'
    
    # Referrer policy
    response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
    
    # Content Security Policy for basic protection
    if not response.headers.get('Content-Security-Policy'):
        csp = (
            "default-src 'self'; "
            "script-src 'self' 'unsafe-inline' cdn.jsdelivr.net; "
            "style-src 'self' 'unsafe-inline' cdn.jsdelivr.net; "
            "font-src 'self' cdn.jsdelivr.net; "
            "img-src 'self' data:; "
            "connect-src 'self'"
        )
        response.headers['Content-Security-Policy'] = csp
    
    return response

# Initialize CVE service configuration
config = Config(
    api_key=os.getenv('NVD_API_KEY'),
    timeout=30
)

def get_cve_service():
    """Get CVE service instance for current request"""
    if 'cve_service' not in g:
        g.cve_service = CVEService(config)
    return g.cve_service

@app.teardown_appcontext
def cleanup_resources(exception):
    """Cleanup resources at the end of each request"""
    cve_service = g.pop('cve_service', None)
    if cve_service:
        try:
            cve_service.close()
        except Exception as e:
            logger.error(f"Error closing CVE service: {e}")

# Template helper functions
@app.template_filter('get_severity_class')
def get_severity_class(severity):
    """Template filter for severity CSS classes"""
    if not severity:
        return 'secondary'
    severity = severity.upper()
    if severity in ['CRITICAL', 'HIGH']:
        return 'danger'
    elif severity == 'MEDIUM':
        return 'warning'
    elif severity == 'LOW':
        return 'success'
    else:
        return 'secondary'

def get_session_history() -> List[Dict]:
    """Get CVE history from session"""
    return session.get('cve_history', [])

def add_to_session_history(cve_data: CVEData):
    """Add CVE to session history with robust error handling"""
    try:
        if 'cve_history' not in session:
            session['cve_history'] = []
        
        # Helper function to safely get analysis data
        def safe_analysis(func, default_value):
            try:
                return func()
            except Exception as e:
                print(f"WARNING: Analysis failed, using default: {e}")
                return default_value
        
        # Convert CVEData to dict for session storage (with error handling)
        cve_dict = {
            'cve_id': cve_data.cve_id,
            'published_date': cve_data.published_date.isoformat(),
            'last_modified_date': cve_data.last_modified_date.isoformat(),
            'description': cve_data.description[:200] + '...' if len(cve_data.description) > 200 else cve_data.description,  # Truncate for space
            'cvss_metrics': None,
            'analysis': {
                'exploit_likelihood': safe_analysis(
                    lambda: get_cve_service().get_exploit_likelihood(cve_data), 
                    'UNKNOWN'
                ),
                'patch_available': safe_analysis(
                    lambda: get_cve_service().has_patch_available(cve_data), 
                    False
                ),
                'age_days': safe_analysis(
                    lambda: (datetime.now(timezone.utc) - cve_data.published_date.replace(tzinfo=timezone.utc)).days,
                    0
                )
            }
        }
        
        # Safely add CVSS metrics
        try:
            if cve_data.cvss_metrics:
                cve_dict['cvss_metrics'] = {
                    'version': cve_data.cvss_metrics.version,
                    'base_score': cve_data.cvss_metrics.base_score,
                    'severity': cve_data.cvss_metrics.severity,
                    'vector_string': cve_data.cvss_metrics.vector_string
                }
        except Exception as e:
            print(f"WARNING: Failed to add CVSS metrics to history: {e}")
        
        # Remove if already exists to avoid duplicates
        session['cve_history'] = [cve for cve in session['cve_history'] if cve['cve_id'] != cve_data.cve_id]
        
        # Add to beginning of list
        session['cve_history'].insert(0, cve_dict)
        
        # Keep only last 50 CVEs
        session['cve_history'] = session['cve_history'][:50]
        session.modified = True
        
        print(f"SUCCESS: Added {cve_data.cve_id} to session history")
        
    except Exception as e:
        print(f"ERROR: Failed to add CVE to session history: {e}")
        # Still try to add basic CVE info even if everything else fails
        try:
            if 'cve_history' not in session:
                session['cve_history'] = []
            
            basic_cve = {
                'cve_id': cve_data.cve_id,
                'published_date': cve_data.published_date.isoformat() if cve_data.published_date else '',
                'last_modified_date': cve_data.last_modified_date.isoformat() if cve_data.last_modified_date else '',
                'description': (cve_data.description[:200] + '...' if len(cve_data.description or '') > 200 else cve_data.description) or 'No description available',
                'cvss_metrics': None,
                'analysis': {
                    'exploit_likelihood': 'UNKNOWN',
                    'patch_available': False,
                    'age_days': 0
                }
            }
            
            session['cve_history'] = [cve for cve in session['cve_history'] if cve['cve_id'] != cve_data.cve_id]
            session['cve_history'].insert(0, basic_cve)
            session['cve_history'] = session['cve_history'][:50]
            session.modified = True
            
            print(f"FALLBACK: Added basic info for {cve_data.cve_id} to session history")
            
        except Exception as e2:
            print(f"CRITICAL: Complete failure to add CVE to history: {e2}")

def validate_cve_id(cve_id: str) -> bool:
    """Validate CVE ID format"""
    import re
    pattern = r'^CVE-\d{4}-\d{4,7}$'
    return bool(re.match(pattern, cve_id.upper()))

@app.route('/health')
def health_check():
    """Health check endpoint for monitoring"""
    return {'status': 'healthy', 'timestamp': datetime.now().isoformat()}, 200

@app.route('/')
def index():
    """Main dashboard"""
    try:
        history = get_session_history()
        
        # Fixed timezone handling for recent count
        now_utc = datetime.now(timezone.utc)
        five_days_ago = now_utc - timedelta(days=5)
        
        recent_count = 0
        for cve in history:
            try:
                # Parse published date with proper timezone handling
                pub_date_str = cve['published_date']
                if pub_date_str.endswith('Z'):
                    pub_date_str = pub_date_str[:-1] + '+00:00'
                elif '+' not in pub_date_str and 'T' in pub_date_str:
                    pub_date_str += '+00:00'
                
                pub_date = datetime.fromisoformat(pub_date_str)
                if pub_date >= five_days_ago:
                    recent_count += 1
            except (ValueError, KeyError) as e:
                logger.warning(f"Error parsing date for CVE {cve.get('cve_id', 'unknown')}: {e}")
                continue
        
        stats = {
            'total_analyzed': len(history),
            'recent_analyzed': recent_count,
            'api_key_status': 'Active' if config.api_key else 'None',
            'rate_limit': config.rate_limit
        }
        
        return render_template('index.html', stats=stats, recent_cves=history[:5])
    
    except Exception as e:
        logger.error(f"Dashboard error: {e}")
        return render_template('error.html', error_code=500, error_message="Dashboard temporarily unavailable"), 500

@app.route('/analyze')
def analyze_page():
    """CVE analysis page"""
    return render_template('analyze.html')

@app.route('/api/analyze/<cve_id>')
@limiter.limit("60 per minute")  # Rate limit for CVE analysis  
def analyze_cve(cve_id):
    """Analyze a specific CVE"""
    try:
        if not validate_cve_id(cve_id):
            return jsonify({'error': 'Invalid CVE ID format. Expected: CVE-YYYY-NNNNN'}), 400
        
        cve_data = get_cve_service().get_cve_details(cve_id.upper())
        
        if not cve_data:
            return jsonify({'error': f'CVE {cve_id} not found in NVD database'}), 404
        
        # Add to session history
        add_to_session_history(cve_data)
        
        # Convert to dict for JSON response
        result = {
            'cve_id': cve_data.cve_id,
            'published_date': cve_data.published_date.isoformat(),
            'last_modified_date': cve_data.last_modified_date.isoformat(),
            'description': cve_data.description,
            'cvss_metrics': None,
            'weaknesses': [{'cwe_id': w.cwe_id, 'description': w.description} for w in cve_data.weaknesses],
            'references': [{'url': r.url, 'source': r.source, 'tags': r.tags} for r in cve_data.references],
            'affected_products': [str(p) for p in cve_data.affected_products],
            'analysis': {
                'exploit_likelihood': get_cve_service().get_exploit_likelihood(cve_data),
                'patch_available': get_cve_service().has_patch_available(cve_data),
                'age_days': (datetime.now(timezone.utc) - cve_data.published_date.replace(tzinfo=timezone.utc)).days
            }
        }
        
        if cve_data.cvss_metrics:
            result['cvss_metrics'] = {
                'version': cve_data.cvss_metrics.version,
                'base_score': cve_data.cvss_metrics.base_score,
                'severity': cve_data.cvss_metrics.severity,
                'vector_string': cve_data.cvss_metrics.vector_string
            }
        
        return jsonify(result)
        
    except Exception as e:
        logger.error(f"Error analyzing CVE {cve_id}: {e}")
        return jsonify({'error': str(e)}), 500

@app.route('/search')
def search_page():
    """Search page"""
    return render_template('search.html')

@app.route('/api/search')
@limiter.limit("30 per minute")  # Rate limit for searches
def search_cves():
    """Search CVEs with various filters"""
    try:
        keyword = request.args.get('keyword', '').strip()
        product = request.args.get('product', '').strip()
        severity = request.args.get('severity', '').strip()
        days_back = request.args.get('days_back', type=int)
        max_results = min(request.args.get('max_results', 20, type=int), 100)
        
        # Create a unique cache key based on search parameters
        cache_key = f"search_{hash(f'{keyword}_{product}_{severity}_{days_back}_{max_results}')}"
        
        # Check cache first
        cached_result = cache.get(cache_key)
        if cached_result:
            logger.info(f"Returning cached search results for key: {cache_key}")
            return jsonify(cached_result)
        
        # Build search parameters correctly
        kwargs = {}
        if keyword:
            kwargs['keyword'] = keyword
        elif product:
            kwargs['product'] = product
        
        if severity and severity in ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL']:
            kwargs['severity'] = severity
        
        if days_back and days_back > 0:
            kwargs['days_back'] = days_back
        
        kwargs['max_results'] = max_results
        
        # Perform search
        results = get_cve_service().search_cves(**kwargs)
        
        # Convert results to dict format
        search_results = []
        for cve_data in results:
            result_dict = {
                'cve_id': cve_data.cve_id,
                'published_date': cve_data.published_date.isoformat(),
                'description': cve_data.description[:200] + '...' if len(cve_data.description) > 200 else cve_data.description,
                'cvss_metrics': None,
                'analysis': {
                    'exploit_likelihood': get_cve_service().get_exploit_likelihood(cve_data),
                    'age_days': (datetime.now(timezone.utc) - cve_data.published_date.replace(tzinfo=timezone.utc)).days
                }
            }
            
            if cve_data.cvss_metrics:
                result_dict['cvss_metrics'] = {
                    'base_score': cve_data.cvss_metrics.base_score,
                    'severity': cve_data.cvss_metrics.severity
                }
            
            search_results.append(result_dict)
        
        # Sort results by date (newest first) and then by severity (most critical first)
        def get_sort_key(item):
            # Extract DATE only (without time) for primary sorting
            date_str = item['published_date']
            date_only = date_str.split('T')[0]  # Get YYYY-MM-DD part only
            
            # Extract severity with better error handling
            severity = 'N/A'  # Default value
            if item.get('cvss_metrics') and item['cvss_metrics'] is not None:
                severity = item['cvss_metrics'].get('severity', 'N/A')
            
            # Ensure severity is uppercase and handle None/empty values
            if severity is None or severity == '':
                severity = 'N/A'
            else:
                severity = str(severity).upper()
            
            # Map severity to sort order (higher number = more critical)
            severity_order = {'CRITICAL': 4, 'HIGH': 3, 'MEDIUM': 2, 'LOW': 1, 'N/A': 0}
            severity_score = severity_order.get(severity, 0)
            
            return (date_only, severity_score)
        
        search_results.sort(key=get_sort_key, reverse=True)
        
        result = {
            'results': search_results,
            'total': len(search_results),
            'query': {
                'keyword': keyword or '',
                'product': product or '',
                'severity': severity or '',
                'days_back': days_back or 0
            }
        }
        
        # Cache the result for 5 minutes with unique key
        cache.set(cache_key, result, timeout=300)
        logger.info(f"Cached search results for key: {cache_key}")
        
        return jsonify(result)
        
    except Exception as e:
        logger.error(f"Error searching CVEs: {e}")
        return jsonify({'error': str(e)}), 500

@app.route('/recent')
def recent_page():
    """Recent CVEs page"""
    return render_template('recent.html')

@app.route('/api/recent')
def get_recent_cves():
    """Get recent CVEs with proper chronological sorting"""
    try:
        days = request.args.get('days', 5, type=int)
        severity = request.args.get('severity', '').strip()
        max_results = min(request.args.get('max_results', 100, type=int), 2000)  # Allow higher limit for quick filters
        page = request.args.get('page', 1, type=int)
        per_page = min(request.args.get('per_page', 50, type=int), 100)
        
        # Validate input
        original_days = days
        days = max(1, min(days, 10))  # Limit to 1-10 days (matches cache period)
        page = max(1, page)
        
        logger.info(f"Fetching recent CVEs: days={days}, severity={severity}, max_results={max_results}")
        
        # Use proper NVD API date parameters with correct format
        logger.info("Using NVD API date parameters with proper ISO-8601 format")
        
        try:
            # First try: Use date-based search with reasonable range
            if severity and severity in ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL']:
                all_results = get_cve_service().search_cves(
                    severity=severity, 
                    days_back=min(days, 120),  # Respect API limit
                    max_results=max_results  # Honor user's max_results selection
                )
            else:
                all_results = get_cve_service().search_cves(
                    days_back=min(days, 120),  # Respect API limit
                    max_results=max_results  # Honor user's max_results selection
                )
            
            logger.info(f"Date-based search returned {len(all_results)} CVEs")
            
            # With the new cache system, we trust the results - no fallback expansion
            # If there are 0 CVEs for a date range, that's the correct answer
            
        except Exception as api_error:
            logger.error(f"NVD API error: {api_error}")
            # Final fallback: try keyword search without date restrictions
            logger.info("Attempting fallback keyword search...")
            try:
                if severity and severity in ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL']:
                    all_results = get_cve_service().search_cves(
                        keyword="microsoft",  # Popular keyword for good results
                        severity=severity, 
                        max_results=200
                    )
                else:
                    all_results = get_cve_service().search_cves(
                        keyword="microsoft",  # Popular keyword for good results
                        max_results=200
                    )
                
                logger.info(f"Fallback keyword search returned {len(all_results) if all_results else 0} CVEs")
                
            except Exception as fallback_error:
                logger.error(f"Fallback search also failed: {fallback_error}")
                all_results = []
        
        # Calculate pagination
        total_results = len(all_results)
        start_index = (page - 1) * per_page
        end_index = start_index + per_page
        paginated_results = all_results[start_index:end_index]
        
        # Note: We don't artificially limit total_results for pagination
        # This allows proper pagination through all available results
        
        # Convert to dict format
        recent_cves = []
        for cve_data in paginated_results:
            result_dict = {
                'cve_id': cve_data.cve_id,
                'published_date': cve_data.published_date.isoformat(),
                'description': cve_data.description[:200] + '...' if len(cve_data.description) > 200 else cve_data.description,
                'cvss_metrics': None,
                'analysis': {
                    'exploit_likelihood': get_cve_service().get_exploit_likelihood(cve_data),
                    'age_days': (datetime.now(timezone.utc) - cve_data.published_date.replace(tzinfo=timezone.utc)).days
                }
            }
            
            if cve_data.cvss_metrics:
                result_dict['cvss_metrics'] = {
                    'base_score': cve_data.cvss_metrics.base_score,
                    'severity': cve_data.cvss_metrics.severity
                }
            
            recent_cves.append(result_dict)
        
        # Calculate pagination info
        total_pages = (total_results + per_page - 1) // per_page
        has_next = page < total_pages
        has_prev = page > 1
        
        logger.info(f"Pagination calc: total_results={total_results}, per_page={per_page}, total_pages={total_pages}, page={page}, has_next={has_next}, has_prev={has_prev}")
        
        return jsonify({
            'results': recent_cves,
            'pagination': {
                'page': page,
                'per_page': per_page,
                'total': total_results,
                'pages': total_pages,
                'has_next': has_next,
                'has_prev': has_prev
            },
            'query_info': {
                'days': days,
                'original_days': original_days,
                'severity': severity or 'ALL',
                'max_results': max_results,
                'note': f"Expanded search to {days} days" if days != original_days else None
            }
        })
        
    except Exception as e:
        logger.error(f"Error getting recent CVEs: {e}")
        return jsonify({'error': str(e)}), 500

@app.route('/bulk')
def bulk_page():
    """Bulk analysis page"""
    return render_template('bulk.html')

@app.route('/api/bulk', methods=['POST'])
@limiter.limit("5 per minute")  # Strict rate limit for bulk operations
def bulk_analyze():
    """Bulk analyze CVEs"""
    try:
        data = request.get_json()
        if not data:
            return jsonify({'error': 'Invalid JSON data'}), 400
            
        cve_ids = data.get('cve_ids', [])
        
        if not cve_ids:
            return jsonify({'error': 'No CVE IDs provided'}), 400
        
        # Input validation - limit number of CVEs to prevent DoS
        if len(cve_ids) > 50:
            return jsonify({'error': 'Maximum 50 CVE IDs allowed per request'}), 400
        
        # Validate CVE IDs
        valid_cve_ids = []
        for cve_id in cve_ids:
            if not isinstance(cve_id, str):
                continue
            cve_id = cve_id.strip()
            if len(cve_id) > 20:  # CVE IDs shouldn't be longer than this
                continue
            if validate_cve_id(cve_id):
                valid_cve_ids.append(cve_id.upper())
        
        if not valid_cve_ids:
            return jsonify({'error': 'No valid CVE IDs found'}), 400
        
        # Analyze CVEs
        results = get_cve_service().analyze_multiple_cves(valid_cve_ids)
        
        # Add successful results to session
        for cve_data in results:
            add_to_session_history(cve_data)
        
        # Calculate summary statistics
        severity_counts = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "N/A": 0}
        for cve in results:
            if cve.cvss_metrics:
                severity = cve.cvss_metrics.severity.upper()
                severity_counts[severity] = severity_counts.get(severity, 0) + 1
            else:
                severity_counts["N/A"] += 1
        
        risk_score = (severity_counts["CRITICAL"] * 4 + 
                     severity_counts["HIGH"] * 3 + 
                     severity_counts["MEDIUM"] * 2 + 
                     severity_counts["LOW"] * 1)
        
        # Convert results to dict format
        analyzed_cves = []
        for cve_data in results:
            result_dict = {
                'cve_id': cve_data.cve_id,
                'published_date': cve_data.published_date.isoformat(),
                'description': cve_data.description,
                'cvss_metrics': None,
                'analysis': {
                    'exploit_likelihood': get_cve_service().get_exploit_likelihood(cve_data),
                    'patch_available': get_cve_service().has_patch_available(cve_data),
                    'age_days': (datetime.now(timezone.utc) - cve_data.published_date.replace(tzinfo=timezone.utc)).days
                }
            }
            
            if cve_data.cvss_metrics:
                result_dict['cvss_metrics'] = {
                    'version': cve_data.cvss_metrics.version,
                    'base_score': cve_data.cvss_metrics.base_score,
                    'severity': cve_data.cvss_metrics.severity
                }
            
            analyzed_cves.append(result_dict)
        
        return jsonify({
            'results': analyzed_cves,
            'summary': {
                'requested_count': len(valid_cve_ids),
                'analyzed_count': len(results),
                'severity_breakdown': severity_counts,
                'risk_score': risk_score
            }
        })
        
    except Exception as e:
        logger.error(f"Error bulk analyzing CVEs: {e}")
        return jsonify({'error': str(e)}), 500

@app.route('/history')
def history_page():
    """Session history page"""
    history = get_session_history()
    
    # Calculate statistics
    stats = {
        'total_cves': len(history),
        'critical_high_count': 0,
        'patches_available_count': 0,
        'avg_age_days': 0
    }
    
    if history:
        total_age = 0
        for cve in history:
            # Critical/High count
            if (cve.get('cvss_metrics') and 
                cve['cvss_metrics'].get('severity', '').upper() in ['CRITICAL', 'HIGH']):
                stats['critical_high_count'] += 1
            
            # Patches available count
            if cve.get('analysis', {}).get('patch_available', False):
                stats['patches_available_count'] += 1
            
            # Age calculation
            if cve.get('analysis', {}).get('age_days'):
                total_age += cve['analysis']['age_days']
        
        stats['avg_age_days'] = round(total_age / len(history)) if len(history) > 0 else 0
    
    return render_template('history.html', history=history, stats=stats)

@app.route('/api/history/clear', methods=['POST'])
def clear_history():
    """Clear session history"""
    session.pop('cve_history', None)
    session.modified = True
    return jsonify({'success': True})

@app.route('/export')
def export_page():
    """Export page"""
    history = get_session_history()
    return render_template('export.html', history_count=len(history))

@app.route('/api/export/<format>')
def export_data(format):
    """Export session data"""
    try:
        history = get_session_history()
        
        if not history:
            return jsonify({'error': 'No data to export'}), 400
        
        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
        
        if format == 'json':
            # Export as JSON with proper cleanup
            export_data = {
                "export_date": datetime.now(timezone.utc).isoformat(),
                "cve_count": len(history),
                "cves": history
            }
            
            # Create temporary file with proper cleanup
            temp_file = tempfile.NamedTemporaryFile(mode='w', suffix='.json', delete=True)
            try:
                json.dump(export_data, temp_file, indent=2, ensure_ascii=False)
                temp_file.flush()  # Ensure data is written
                
                # Use send_file with proper cleanup
                return send_file(
                    temp_file.name,
                    as_attachment=True,
                    download_name=f'cve_export_{timestamp}.json',
                    mimetype='application/json'
                )
            finally:
                # File will be automatically deleted due to delete=True
                pass
        
        elif format == 'csv':
            # Export as CSV with security escaping
            output = io.StringIO()
            writer = csv.writer(output, quoting=csv.QUOTE_ALL)  # Quote all fields for security
            
            # Write header
            writer.writerow(['CVE ID', 'Published Date', 'Severity', 'Score', 'Description', 'Exploit Likelihood'])
            
            # Write data with proper escaping
            for cve in history:
                severity = 'N/A'
                score = 'N/A'
                if cve.get('cvss_metrics'):
                    severity = str(cve['cvss_metrics']['severity'])
                    score = str(cve['cvss_metrics']['base_score'])
                
                # Sanitize description to prevent CSV injection
                description = cve.get('description', '')
                if description:
                    # Remove potential CSV injection characters
                    description = description.replace('\n', ' ').replace('\r', ' ')
                    # Truncate and escape HTML entities
                    if len(description) > 100:
                        description = description[:100] + '...'
                    description = html.escape(description)
                
                writer.writerow([
                    html.escape(str(cve.get('cve_id', ''))),
                    cve.get('published_date', '')[:10],  # Date only
                    html.escape(severity),
                    score,
                    description,
                    html.escape(str(cve.get('analysis', {}).get('exploit_likelihood', 'N/A')))
                ])
            
            # Create response
            output.seek(0)
            return app.response_class(
                output.getvalue(),
                mimetype='text/csv',
                headers={"Content-disposition": f"attachment; filename=cve_export_{timestamp}.csv"}
            )
        
        else:
            return jsonify({'error': 'Invalid export format'}), 400
            
    except Exception as e:
        logger.error(f"Error exporting data: {e}")
        return jsonify({'error': str(e)}), 500

@app.route('/settings')
def settings_page():
    """Settings page"""
    return render_template('settings.html', config={
        'api_key_status': 'Set' if config.api_key else 'Not Set',
        'rate_limit': config.rate_limit,
        'timeout': config.timeout
    })

@app.route('/api/test-connection')
def test_connection():
    """Test NVD API connection"""
    try:
        # Test with a known CVE
        test_data = get_cve_service().get_cve_details("CVE-2021-44228")
        if test_data:
            return jsonify({
                'success': True,
                'message': 'API connection successful',
                'api_key_status': 'Active' if config.api_key else 'None',
                'rate_limit': config.rate_limit
            })
        else:
            return jsonify({'success': False, 'message': 'API connection failed'}), 500
    except Exception as e:
        logger.error(f"Error testing API connection: {e}")
        return jsonify({'success': False, 'message': str(e)}), 500

@app.route('/api/cache/clear', methods=['POST'])
def clear_cache():
    """Clear all cache entries"""
    try:
        cache.clear()
        cve_service = get_cve_service()
        cve_service.clear_cache()  # Also clear the CVE service master cache
        logger.info("All caches cleared successfully")
        return jsonify({
            'success': True,
            'message': 'All caches cleared successfully'
        })
    except Exception as e:
        logger.error(f"Error clearing cache: {e}")
        return jsonify({
            'success': False,
            'message': f'Error clearing cache: {str(e)}'
        }), 500

# Error handlers
@app.errorhandler(404)
def not_found(error):
    """404 error handler"""
    logger.warning(f"404 error: {request.url}")
    return render_template('error.html', error_code=404, error_message="Page not found"), 404

@app.errorhandler(500)
def server_error(error):
    """500 error handler"""
    logger.error(f"500 error: {error}")
    return render_template('error.html', error_code=500, error_message="Internal server error"), 500

@app.errorhandler(RequestEntityTooLarge)
def file_too_large(error):
    """File too large error handler"""
    logger.warning(f"File too large error from {request.remote_addr}")
    return jsonify({'error': 'File too large. Maximum size is 16MB.'}), 413

@app.errorhandler(Exception)
def handle_exception(error):
    """Global exception handler"""
    logger.error(f"Unhandled exception: {error}", exc_info=True)
    
    # For API endpoints, return JSON error
    if request.path.startswith('/api/'):
        return jsonify({'error': 'Internal server error'}), 500
    
    # For web pages, return error template
    return render_template('error.html', error_code=500, error_message="Internal server error"), 500

if __name__ == '__main__':
    # Ensure templates and static directories exist
    os.makedirs('templates', exist_ok=True)
    os.makedirs('static', exist_ok=True)
    
    # Production-safe configuration
    debug_mode = os.environ.get('FLASK_ENV') == 'development'
    
    # Run the application with proper configuration
    app.run(
        debug=debug_mode,
        host='127.0.0.1' if debug_mode else '0.0.0.0',
        port=int(os.environ.get('PORT', 5000))
    )